4c33b1
From 29c759284e305ec428703c9a5831d0b1fc3497ef Mon Sep 17 00:00:00 2001
4c33b1
From: Werner Lemberg <wl@gnu.org>
4c33b1
Date: Sat, 27 Jan 2018 14:43:43 +0100
4c33b1
Subject: [PATCH] * src/truetype/ttinterp.c (Ins_GETVARIATION): Avoid NULL
4c33b1
 reference.
4c33b1
4c33b1
Reported as
4c33b1
4c33b1
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5736
4c33b1
---
4c33b1
 src/truetype/ttinterp.c | 12 ++++++++++--
4c33b1
 1 files changed, 10 insertions(+), 2 deletions(-)
4c33b1
4c33b1
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
4c33b1
index d855aaaa9..551f14a2e 100644
4c33b1
--- a/src/truetype/ttinterp.c
4c33b1
+++ b/src/truetype/ttinterp.c
4c33b1
@@ -7470,8 +7470,16 @@
4c33b1
       return;
4c33b1
     }
4c33b1
 
4c33b1
-    for ( i = 0; i < num_axes; i++ )
4c33b1
-      args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */
4c33b1
+    if ( coords )
4c33b1
+    {
4c33b1
+      for ( i = 0; i < num_axes; i++ )
4c33b1
+        args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */
4c33b1
+    }
4c33b1
+    else
4c33b1
+    {
4c33b1
+      for ( i = 0; i < num_axes; i++ )
4c33b1
+        args[i] = 0;
4c33b1
+    }
4c33b1
   }
4c33b1
 
4c33b1
 
4c33b1
-- 
4c33b1
2.14.3
4c33b1